You can deploy this model and start earning money today!

VarunGowda/
crypto-binary-detector

Views

No views yet

🔐 Crypto Binary Detector — XGBoost Model

Runtime detection of cryptographic algorithms in Linux ELF binaries using an XGBoost classifier trained on 80 static features extracted from compiled binaries.

Model Performance

Metric	Test Set	5-Fold CV (mean ± std)
Accuracy	95.74%	94.05% ± 3.52%
F1 Score	93.33%	90.71% ± 5.23%
ROC AUC	95.83%	98.17% ± 1.50%
MCC	90.21%	87.05% ± 7.19%

Overfitting gap: 2.1% (Train acc 97.8% vs Test acc 95.7%) ✅

Top 10 Discriminative Features

Selected via ensemble ranking (Mutual Information + XGBoost importance + Pearson Correlation):

Rank	Feature	What it Captures
1	`crypto_string_ratio`	Ratio of crypto-related strings (aes, sha, encrypt, etc.)
2	`sec_entropy_max`	Maximum section entropy — crypto code has distinctive high-entropy sections
3	`crypto_constant_hits`	YARA-like scan for AES S-box, SHA init vectors, DES tables
4	`text_rotate_density`	ROL/ROR instruction density — crypto uses heavy bitwise rotation
5	`sec_rodata_entropy`	.rodata section entropy — lookup tables (S-boxes) are high entropy
6	`sec_text_entropy`	.text section entropy — crypto round functions are near-uniform
7	`text_xor_density`	XOR instruction density — core crypto operation
8	`sec_entropy_std`	Entropy variation across sections — crypto binaries show wider range
9	`n_crypto_strings`	Count of crypto-related strings in binary
10	`avg_string_len`	Average string length — structural indicator

Anti-Overfitting Measures

L1 regularization (reg_alpha=0.5)
L2 regularization (reg_lambda=2.0)
Shallow trees (max_depth=5, tuned via GridSearch)
Row subsampling (subsample=0.8)
Column subsampling (colsample_bytree=0.8, colsample_bylevel=0.8)
Minimum child weight = 3
Gamma / min split loss = 0.1
Stratified 5-Fold CV
Class imbalance handling (scale_pos_weight=2.25)
Learning curve analysis

Dataset

232 Linux ELF binaries compiled from 29 unique C programs
9 crypto programs: Custom AES (S-box), SHA-256, SHA-1, MD5, RC4, DES, ChaCha20, Blowfish, XOR cipher
20 non-crypto programs: Sorting algorithms, data structures, string ops, file I/O, math, signal processing, etc.
8 compile variants per source: -O0, -O2, -Os, -O3, PIE, stripped, static
80 features extracted per binary using LIEF + custom analysis

Usage

python

import xgboost as xgb
import json

# Load model
model = xgb.XGBClassifier()
model.load_model("crypto_detector_xgboost.json")

# Load feature list
with open("top10_features.json") as f:
    features = json.load(f)["features"]

# Extract features from a binary (see scripts/feature_extraction.py)
# features_dict = extract_features("/path/to/binary")
# X = [features_dict[f] for f in features]
# prediction = model.predict([X])

Files

crypto_detector_xgboost.json — Trained XGBoost model
top10_features.json — Feature names and ranking details
results_summary.json — Full evaluation metrics
figures/ — Visualizations (SHAP, ROC, learning curves, etc.)
scripts/ — Full pipeline: dataset creation, feature extraction, training

References

EMBER feature engineering (Anderson & Roth, 2018) adapted for ELF
LIEF library for binary parsing
SHAP for model interpretability

VarunGowda/crypto-binary-detector